WoSuchfor the WoSuch platform (website and mobile app)
As of: September 2026
Este documento solo está disponible en inglés por el momento. La versión alemana es la vinculante.
This Privacy Policy describes which personal data are processed when you use WoSuch, for what purpose, on what legal basis and for how long. It is based on the General Data Protection Regulation (DSGVO), the Austrian Data Protection Act (DSG) and the TKG 2021.
WoSuch is established in Austria. For users in Germany and Switzerland this policy applies accordingly; mandatory provisions of the respective country of residence remain unaffected.
Mykola Gnylytskyy
Gentzgasse 21
1180 Wien
Austria
Email: kontakt@wosuch.com
No data protection officer needs to be appointed under Art. 37 DSGVO: the processing is not a core activity within the meaning of that provision, and no special categories of data under Art. 9 DSGVO are processed. Please send data protection inquiries to the address above.
We process personal data only to the extent necessary to operate the platform or where you have given your consent.
Three commitments that follow from the architecture of the platform, not merely from an intention:
We state one exception to the second commitment explicitly: if you contact a provider via the platform, the provider receives the details you have released for that purpose. See 3.4.
3.1 Use without an account
When you open the website or launch the app, we process the technically necessary connection data (IP address, time, requested resource, device type, error messages). They arise at our hosting providers and serve the operation and security of the platform. Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in secure operation). Retention: see section 6.
The interactive map, the AI assistant and audience measurement are initially disabled and are only enabled after your respective consent. You can choose each of the three functions individually; the platform can also be used without them.
3.2 Account
To create an account, we process your email address and a password stored in encrypted form. The email address is required because it is used for signing in. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.
Optional and only if you enter them yourself: first name, last name, phone number. These details serve solely to let you fill in the contact form to a provider more quickly. The account is fully usable without them. Legal basis: Art. 6 Abs. 1 lit. a DSGVO.
We also store with your account the language you have chosen, the display mode (light/dark), the selected country and three notification switches. The chosen language also determines the language of notifications. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.
3.3 Watchlist and recently viewed listings
For signed-in users, we store which listings you have added to your watchlist and which you have recently viewed, so that you can find them again in your account.
The list of recently viewed listings is not a running log: at most one entry is kept per listing, and viewing the listing again updates that entry. Legal basis: watchlist Art. 6 Abs. 1 lit. b DSGVO; recently viewed listings Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in usability). Retention: see section 6.
3.4 Contacting a provider
When you tap "Contact" on a listing, the contact is recorded in your account so that you can find it again under "My Inquiries". The record contains the listing, the time and the type of contact (phone, email, web).
We do not store the content of a phone call or an email. The contact and all further communication take place directly between you and the provider, outside the platform.
The details you have optionally provided — name and phone number — are transmitted to the provider only at that moment and only upon your action. Without this action they do not leave the platform. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.
Counting of contact requests. Regardless of whether you are signed in and whether you have consented to audience measurement, we count how often the phone number or e-mail address of a listing was requested. We store only the listing, where applicable the unit of a new-build project, the channel (phone or e-mail), the platform (web or app), the country, the provider and the time — no information about you and no session or device identifier. The count is used for billing providers and shows them how many requests their listings receive. To avoid counting the same request twice, we use the hash value described in 3.9. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in accurate billing of providers).
3.5 Search agents and notifications
You can create search agents with filter criteria. We check newly published and updated listings against these criteria and notify you of a match, provided you have enabled notifications.
Processed: the name of the search agent, the filter criteria, the selected country, the time of the last notification. For push notifications, additionally a device identifier issued by the push service.
For every notification sent, we keep an entry with the search agent, the listing and the channel. Its sole purpose is to avoid sending the same notification more than once. Legal basis: Art. 6 Abs. 1 lit. a DSGVO. You can disable or delete search agents and notifications at any time. Retention: see section 6.
3.6 AI assistant
The AI assistant requires an account and your consent; without both it is disabled. Use without an account is not provided for.
The text of your request is transmitted to Anthropic PBC in the USA for evaluation and processed there in real time. The response and the search criteria derived from it are stored by us as a conversation history so that you can continue the conversation.
To limit costs, we keep a counter of requests per account and day; the limit is 20 requests per day.
Please do not enter any information into the assistant that you do not wish to transmit. Information about your person is not required for the search. Legal basis: Art. 6 Abs. 1 lit. a DSGVO for the processing, Art. 46 DSGVO (standard contractual clauses) for the transfer to the USA. See section 5. Retention: see section 6.
3.7 Map view
To display the interactive map, we integrate Mapbox Inc. (USA). In doing so, your IP address is transmitted to Mapbox because the map tiles are loaded from its servers. We do not store raw GPS data from your device.
Without your consent, the map remains disabled: the website shows a static preview, the app shows the list of listings. Search works in both cases. Legal basis: Art. 6 Abs. 1 lit. a DSGVO for the processing, Art. 46 DSGVO (standard contractual clauses) for the transfer to the USA.
Street View. For many listings you can open a street-level view. Nothing is loaded until you tap it; all that is shown beforehand is a sample image stored by us. Only upon your action is the panorama view loaded from Google LLC (USA). In the process, your IP address and the coordinates of the listing are transmitted to Google, and Google may store its own identifiers on your device, whose purpose and duration are determined by Google. Legal basis: Art. 6 Abs. 1 lit. a DSGVO; tapping the preview counts as your consent, about which we inform you immediately beforehand. Art. 46 DSGVO (standard contractual clauses) for the transfer to the USA.
3.8 Audience measurement
With your consent, we record which listings are displayed and opened and which contact buttons are used. These metrics show commercial providers the visibility of their own listings and serve to improve the platform.
Processed: a random session identifier, the listing identifier, the type of event, the time, the country and the platform (web or app). No user identifier is recorded; the corresponding column was removed in September 2026.
A note on the precision of terms: these data are pseudonymized, not anonymous. The session identifier makes it possible to link the events of one session without our being able to attribute them to a person. We therefore do not describe them as anonymous.
The events are received on the server side. We derive the attribution to the respective provider from the listing, not from information supplied by the device.
Without your consent, no event is recorded and no session identifier is generated. Legal basis: Art. 6 Abs. 1 lit. a DSGVO. Retention: see section 6.
3.9 Protection against automated requests and double counting
To protect audience measurement against mass-generated events and to avoid counting the same contact request twice (3.4), we derive a shortened hash value from your IP address and a secret additional value. For audience measurement we use it to count events per minute; for contact requests we use it to check whether a request for the same listing through the same channel has already been counted on the same day. The IP address itself is not stored, and it cannot be recovered from the hash value. The hash value is stored separately and is not linked to the counted contact request. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against abuse and in accurate counting). Retention: two hours for audience measurement, 48 hours for contact requests.
3.10 Records of your consents
Under Art. 7 Abs. 1 DSGVO, we must be able to demonstrate that consent was given. We therefore store for each consent: its subject (General Terms and Conditions and Privacy Policy, map, AI assistant, audience measurement), the version of the respective document, the time, the country, a device identifier and — for consent to the contractual documents — the wording of the version that was shown to you.
A withdrawal is also recorded, so that it is documented from what point the processing ceased. Legal basis: Art. 6 Abs. 1 lit. c DSGVO in conjunction with Art. 7 Abs. 1 DSGVO (legal obligation to demonstrate consent). Retention: see section 6.
We use the following service providers. Data processing agreements under Art. 28 DSGVO are in place with all of them.
No disclosure to other third parties takes place unless we are legally obliged to do so or it is necessary to enforce our rights.
Commercial providers are not processors but controllers in their own right: they are themselves responsible for the content they publish and for the data they receive from you in the course of a contact.
Supabase, Vercel and Render are companies based in the USA, but they operate the infrastructure we use within the European Union. In regular operation, your data do not leave the EU. Access from the USA in the course of technical support cannot be ruled out; standard contractual clauses under Art. 46 DSGVO are in place for this.
Mapbox, Anthropic, Expo, Google and Apple do transfer data to the USA. For the USA there is an adequacy decision of the European Commission (EU-US Data Privacy Framework); in addition, standard contractual clauses under Art. 46 DSGVO are in place with these providers.
The map and the AI assistant additionally require your consent and are disabled without it. The same applies to push notifications: they are only delivered if you have enabled the function.
Deletions are carried out by a nightly process. The periods stated may therefore be extended by up to one day.
Listings are published by commercial providers. They may contain personal data of persons other than you:
The respective provider is responsible for the lawfulness of this content; on publication, the provider assures us that it is entitled to publish it. Please report unlawful content to support@wosuch.com; we examine every report and remove unlawful content without undue delay once we become aware of it.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21 DSGVO).
You can withdraw any consent given at any time with effect for the future (Art. 7 Abs. 3 DSGVO): in the app under Profile → Legal & Privacy → Cookie Preferences, on the website via "Cookie Preferences" in the footer. The lawfulness of processing carried out before the withdrawal remains unaffected.
You can delete your account yourself: in the app under Profile → Delete Account. This deletes your account, your profile details, watchlist, recently viewed listings, inquiries, search agents, AI assistant conversation histories and your consents.
Two sets of data remain, for the following reasons:
Please send requests to kontakt@wosuch.com. We respond within one month (Art. 12 Abs. 3 DSGVO).
You have the right to lodge a complaint with a supervisory authority. The competent authority is the one at the controller's place of establishment:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Wien Phone: +43 1 52 152-0 www.dsb.gv.at
Transmission is encrypted (TLS). The database and the file storage are encrypted. Access to records is restricted at database level: for every table it is defined who may read and write which rows, and this restriction also applies to access through our own applications.
No one can guarantee absolute security for transmission over the internet. We review our measures regularly and adapt them.
The AI assistant is used solely to translate your search request, phrased in your own words, into search criteria and to display matching listings. No assessment of your person takes place, and no profiles of you are created. There is no automated decision with legal effect within the meaning of Art. 22 DSGVO.
For the use of cookies and similar technologies — on the website and in the app — please refer to the Cookie Policy. It names each technology used, its purpose and its retention period.
We update this policy when the processing changes. The currently valid version is available in the app and at wosuch.com, each with a version number. We inform you of material changes in the app and on the website; where a consent is affected, we ask for it again.
The German version of this policy is binding. Translations are provided for information only.
Cookies y privacidad
El mapa lo proporciona Mapbox (EE. UU.); se le transmite su dirección IP. El asistente de IA envía su consulta a Anthropic (EE. UU.). Con su consentimiento también recogemos estadísticas de uso. Puede elegir cada función por separado.